Add support for x-forwarded- HttpServletRequest wrapping [SPR-13614]

[spring-projects-issues]

Rob Winch opened SPR-13614 and commented

It would be ideal if Spring Framework provided a transparent way to support x-forwarded headers similar to Tomcat's RemoteIpFilter. This would provide an application container independent way of supporting x-forwarded headers.

Admittedly, #14743 added support for this. However, this is not ideal because the framework and users must leverage the newly added APIs explicitly. Furthermore, always interpreting the request using x-forwarded- allows forging the address so users should really opt in for this (i.e. by adding a Filter).

---

Affects: 4.2.2

Issue Links:

• Add support for X-Forwarded-Host in ServletUriComponentsBuilder [SPR-10110] #14743 Add support for X-Forwarded-Host in ServletUriComponentsBuilder
• SEC-2792 HeaderChecks not applied to Load Balanced https originated redirects
• SEC-2898 Use ServletUriComponentsBuilder.fromRequest for URL creation
• ForwardedHeaderFilter could support X-Forwarded-Prefix as well [SPR-14270] #18842 ForwardedHeaderFilter could support X-Forwarded-Prefix as well

Referenced from: commits 6fcc869, 36e2dd9, 4cf0b59

0 votes, 5 watchers

[spring-projects-issues]

Rob Winch commented

Another feature that might be good is to allow overriding of the context-path. I'm not sure what standard headers are available for this, but this is something that I commonly see.

For example, a proxy would be at

https://example.com/

Which maps to:

192.168.1.1:8080/example/

The proxy could inject a header that states the context path for URLs should be "" rather than "/example".

[spring-projects-issues]

kane zhu commented

Any documentation or example to demonstrate how to use this new filter?

I'm using spring boot 1.4.1 that depends on spring mvc 4.3.3, but this filter does not work by default. Any suggestion to enable it?

[spring-projects-issues]

Rob Winch commented

Spring Boot has their own support for X-Forwarded headers that leverages the container. See http://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#howto-use-tomcat-behind-a-proxy-server